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Abstract 

In  1992,  The  Insitu  Group  began  development  of  a  very  small,  very  long-range  autonomous 
aircraft  (or  aerosonde)  for  economical  meteorological  reconn<iissance  in  remote  and  oceamc 
regions  of  the  globe.  Prototype  work  was  done  over  the  first  two  years  of  the  program, 
and  in  the  last  half  of  1994  the  focus  moved  to  development  of  an  aircaft  suitable  for  field 
trials.  All  of  the  necessary  components  were  produced  during  the  Phase  I  period,  including 
airframe,  avionics,  powerplant,  ground  equipment,  and  software.  We  are  now  proceeding 
toward  integrated  flight  tests,  and  initial  deployment  in  a  meteorological  field  experiment  late 
in  1995. 
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1  The  aerosonde  program 

Since  1992  The  Insitu  Group  has  been  developing  a  very  small  autonomous  aircraft,  or  aerosonde, 
for  economical  meteorological  reconnaissance  over  oceans  and  remote  areas.  The  program  follows 
from  the  recent  appearance  of  lightweight  avionics  components  -  particularly  GPS  and  satellite 
communications  equipment  -  which  make  it  possible  to  design  long-range,  long-endurance  au¬ 
tonomous  aircraft  of  unprecedentedly  small  size.  Thus  an  aerosonde  will  be  capable  of  about 
7000  km  range,  and  about  4  days  endurance,  but  have  a  gross  weight  less  than  15  kg  (table  1). 
Such  small  size  brings  multiple  economic  benefits,  including  low  costs  of  manufacture  and  use;  easy 
shipment;  assembly  and  operation  by  a  single  person;  opportunistic  basing;  and  independence  of 
elaborate  facilities.  Total  operating  costs  consequently  will  amount  to  only  a  few  tens  of  dollars 
per  flight-hour.  This  level  is  sufficiently  low  to  allow  wide-scale  sounding  operations  by  the  world’s 
meteorological  services,  especially  in  oceanic  ‘‘data  voids”  where  in  situ  data  are  chronically  sparse. 
Indeed  these  operations  should  become  economical  as  never  before,  as  should  a  variety  of  other 
environmental-monitoring  applications  which  can  be  performed  with  lightweight  instrumentation. 

Realisation  of  this  potential  requires  several  years  of  development,  moving  from  prototype  work 
to  an  expanding  series  of  field  trials,  and  transitioning  gradually  to  routine  service.  In  1994  AFOSR 
became  a  sponsor  of  this  program,  adding  its  support  to  contributions  from  the  Marine  Meteorology 
Program  of  the  Office  of  Naval  Research,  and  from  the  Australian  Bureau  of  Meteorology.  Here 
we  report  progress  over  the  six-month  period  covered  by  AFOSR’s  Phase  I  SBIR  contract,  ending 
in  January  1995.  During  this  period  we  moved  from  prototypes  to  development  of  an  initial 
operational  version  of  the  aircraft,  in  preparation  for  field  trials  scheduled  to  begin  in  November 
1995.  These  are  planned  as  part  of  the  Maritime  Continent  Thunderstorm  Experiment  (MCTEX) 
off  the  northern  coast  of  Australia. 

The  prototypes,  three  of  which  were  built  in  1992-93,  demonstrated  in  preliminary  form  most 
of  the  components  needed  for  long-range  autonomous  operations:  airframe,  powerplant,  avionics, 
and  software.  The  move  to  an  operational  version  called  for  a  comprehensive  design  iteration  in 
all  of  these  areas,  with  a  target  specification  as  listed  in  table  1.  For  the  six-month  period  our 
specific  objectives  were  as  follows  [13]: 

1.  Mapping  of  engine  performance,  including  fuel  and  oil  consumption  across  the 
full  power  range 

2.  Qualification  of  flight- control  and  guidance  software  for  airspeeds  between  15  m/ s 
and  35  m/s 

3.  Qualification  for  long-endurance  flight  of: 

(a)  powerplant  and  installation 

(b)  fuel  system 

(c)  avionics 

(d)  ground  station  and  software 

4.  Demonstration  of  routine  operations  without  undercarriage 

5.  Design  and  flight  demonstration  of  a  new  aerosonde  as  specified  in  table  1 

1.1  Review  of  objectives 

Each  of  these  objectives  was  achieved,  although  we  are  still  working  toweud  an  integrated  demon¬ 
stration  of  all  systems  in  flight.  A  summary  of  results  follows;  details  are  discussed  in  later  sections. 
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Table  1:  Projected  Aerosonde  specifications.  The  version  currently  under  development  meets  the 

_ —  -  y*  1  X  1 Ill  ^-T 


Phase  I 

~  1998 

wing  span  [m] 

2.9 

3.0 

wing  area  [sq  m] 

0.55 

0.55 

propeller  diameter  [m] 

0.6 

0.85 

weigt 

its  [kg] 

avionics 

5.0 

2.6 

powerplant 

1.5 

3.2 

airframe 

3.3 

2.5 

gasoline 

4.1 

5.4 

oil 

0.1 

0.3 

gross 

14 

14 

1  performance 

propeller  efficiency 

0.7 

0.8 

engine  rating 

700  W  @  5500  rpm 

800  W  @  5500  rpm 

specific  fuel  consumption  [gm/kWh] 

450 

370 

optimum  L/D  @  SL 

18.5  @  21  m/s 

20  @  20  m/s 

maximum  speed 

38  m/s  @  SL 

57  m/s  @  16  km 

range  to  zero  fuel  @  econ.  cruise  [km] 

3500 

7300 

range  to  zero  fuel  @  max.  speed  [km] 

2200 

5500 

SL  climb  rate  [m/s] 

2.9 

3.4 

service  ceiling  [km] 

5 

16 

time  to  ceiling  at  gross  weight  [hr] 

0.8 

1.3 

climb/descent  cycle  time  [hr] 

1.9 

4 

endurance  in  climb/descent  cycle  [days] 

1.8 

2.8 

endurance  at  SL  [days] 

2.1 

4 
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1.1.1  Engine  performance 

The  engine  developed  for  prototype  aircraft  was  further  modified  during  the  six-month  SBIR 
period,  and  performance  was  extensively  mapped  on  a  bench  dynamometer.  Fuel  consumption  has 
proved  to  be  considerably  better  than  the  target  value,  and  oil  consumption  is  satisfactory. 

1.1.2  Flight  control  and  guidance  software 

Avionics  were  comprehensively  redesigned  for  the  operational  aerosonde  version,  and  most  of  the 
six-month  period  was  devoted  to  (1)  adapting  prototype  software  to  the  new  hardware,  and  (2)  de¬ 
veloping  a  hardware-in-loop  simulator  for  testing  aircraft  systems  on  the  ground.  The  main  ele¬ 
ments  of  adaptation  and  testing  were  complete  by  the  end  of  January,  and  flight-control  software 
was  requalified  in  simulation  over  the  full  airspeed,  weight,  and  centre-of-gravity  envelope.  Flight 
tests  are  planned  for  April.  Software  is  written  in  C,  and  the  onboard  executable  size  is  124KB. 

1.1.3  Aerosonde  systems 

1.  Powerplant  and  installation 

Substantial  work  was  done  on  carburetion  to  achieve  reliable  operation  at  near-stoichiometric 
fuel/air  ratio.  This  work  encompassed  both  carburettor  hardware  and  mixture-control  soft¬ 
ware.  Results  are  satisfactory  for  flight  testing  and  initial  field  trials,  but,  at  the  same  time, 
we  can  see  significant  room  for  improvement  later  in  the  program. 

Mechanical  reliability  appears  to  be  satisfactory,  although  only  after  a  series  of  connecting- 
rod  failures  prompted  redesign  of  lubrication  arrangements.  Our  prototype  “total-loss”  (t.e. 
single  pass)  oiling  with  gravity  feed  was  replaced  by  a  circulating  system  that  pumps  oil 
through  the  crankcase.  We  have  accumulated  about  50  hours  of  each  of  two  engines,  one 
running  exclusively  on  the  bench  dynamometer,  and  the  other  both  on  the  dyno  and  in  flight. 
The  record  is  encouraging,  but  we  continue  to  build  engine  time  and  to  look  for  problems. 

Under  the  powerplant  heading  we  include  the  onboard  generator  as  well  as  the  engine.  Several 
electrical-system  iterations  were  required  over  the  Phase  I  period  and  beyond,  encompassing 
the  generator,  drive,  and  power-regulation  circuitry.  Flight  hardware  was  completed  only  at 
the  end  of  March. 

2.  Fuel  system 

The  specific  concern  in  fuel  system  design  has  been  to  exclude  the  possibility  of  air  bubbles 
regardless  of  aircraft  attitude  and  fuel  level.  (Even  a  small  bubble  can  stop  the  engine,  and 
at  present  the  aircraft  has  no  provision  for  in-flight  restart.)  A  simple  bladder  has  proven 
effective,  although  care  must  be  taken  to  ensure  that  the  bladder  and  plumbing  are  purged 
of  air  prior  to  flight. 

3.  Avionics 

During  the  Phase  I  period  the  prototype  avionics  were  completely  redesigned.  New  com¬ 
ponents  were  added,  the  flight  computer,  GPS,  and  communications  system  were  changed, 
circuitry  was  revised,  and  packaging  was  very  substantially  improved.  The  first  new  avionics 
set  was  completed  in  January.  Since  then  it  has  performed  well  in  hardware-in-loop  simula¬ 
tion,  and  flight  testing  is  imminent.  Table  3  lists  the  main  components,  and  figure  8  shows 
the  layout  in  block-diagram  form. 

4.  Ground  station  and  software 

The  new  avionics  set  required  a  new  ground-station  architecture  as  shown  in  figure  9.  It 
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Figure  2:  The  second  aerosonde  prototype  in  its  cartop  launcher.  The  cradle  is  hinged  at  left. 
At  flying  speed  the  aircraft  lifts  off  the  roof,  pulling  a  ripcord  as  it  goes;  this  allows  the  cradle  to 
spring  open,  and  the  aircraft  flies  free. 


includes  a  PC  for  supervisory  control,  and  a  pilot’s  manual  control  console,  each  of  which 
communicates  with  the  aircraft  through  a  new  “switchboard”  computer.  The  latter  is  a 
stripped-down  version  of  the  onboard  avionics  set.  New  software  was  developed  for  this 
module  (totalling  69KB  executable),  and  ground-PC  software  from  the  prototype  was  ex¬ 
tensively  modified  (614KB  executable).  The  hardware  and  most  of  the  software  work  were 
complete  at  the  end  of  the  Phase  I  period,  but  software  modifications  and  enhancements  are 
ongoing.  Coding  is  in  C. 


1.1.4  Operations  without  undercarriage 

Prototype  aerosondes  were  fitted  with  landing  gear,  but  operation  without  undercarriage  has  now 
become  routine.  The  aircraft  is  launched  from  a  cartop  cradle  (figure  2)  at  about  20  m/s.  It  lands 
on  the  belly,  with  a  run  of  several  tens  of  metres  on  dry  grass. 

1.1.5  Design  and  flight  demonstration  of  a  new  aerosonde 

Structural  design  of  the  new  aerosonde  version  has  been  much  improved  over  the  three  prototype 
aircraft,  and  airframe  weight  has  come  out  slightly  below  the  target  specification.  Three  new 
airframes  were  in  hand  at  the  end  of  the  January,  with  structural  features  as  listed  in  table  2. 
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Flight  tests  began  in  January  to  evaluate  handling,  engine  behaviour,  and  fuel-system  reliability. 
These  were  flown  with  a  hobbyist-type  radio-control  system,  pending  completion  of  avionics  and 
software  work.  To  date  only  a  few  minor  problems  have  been  found.  We  are  now  preparing  for 
tests  with  full  avionics,  and  for  demonstration  of  long-endurance  capability. 


2  Powerplant 

The  powerplant  is  a  major  development  item  in  most  new  aircraft  programs,  and  the  aerosonde 
program  is  no  exception.  In  our  case  special  engineering  is  necessary  because  of  the  combination 
of  small  scale  and  the  premium  placed  on  reliability  and  fuel  consumption.  For  other  small  engines 
{e.g.  in  model  aircraft  and  garden  tools)  these  are  not  such  high  priorities,  and  their  fuel  con¬ 
sumption  in  particular  is  generally  very  poor  —  e,g,  order  1000  gm/kWh  or  worse  for  a  two-stroke 
“weed-wacker” ,  vs.  less  than  300  gm/kWh  for  a  typical  car.  Hence  although  we  take  a  model- 
aircraft  engine  as  our  starting  point,  modification  is  necessary  to  achieve  satisfactory  performance. 


2,1  Engine  modifications 

The  aerosonde  engine  is  a  20  cc,  single-cylinder  four-stroke  made  by  Enya  (Yokohama).  We  were 
drawn  to  engines  of  this  class  because  they  are  favoured  for  modification  in  “Mileage  Marathon” 
competitions  for  lightweight  land  vehicles,  and  hence  have  demonstrated  potential  for  high  effi¬ 
ciency.  Our  own  modifications  are  as  follows: 

1.  Conversion  to  gasoline 

The  engine  is  designed  for  compression  ignition  with  “glow  fuel”  (nitro-methanol).  Simplicity 
makes  this  the  system  of  choice  for  model  aircraft,  but  it  is  unacceptable  for  us  because  it 
leads  to  very  high  fuel  consumption.  (Glow  fuel  has  less  than  half  the  energy  of  gasoline  per 
unit  mass).  Hence  we  convert  to  spark  ignition  (from  CH  Electronics,  Riverton,  Wyoming) 
and  run  on  lOOLL  aviation  gasoline.  We  modify  the  exhaust  camshaft  to  trigger  a  hall-effect 
ignition  switch  once  per  engine  cycle. 

2.  Carburettor 

The  switch  to  gasoline  dramatically  lowers  fuel  flow,  and  consequently  requires  a  new  carbu¬ 
rettor.  By  a  fortunate  coincidence ,Walbro  (Cass  City,  Michigan)  has  just  introduced,  for  an 
entirely  different  purpose,  a  carburettor  which  meets  our  needs.  It  is  the  product  of  pending 
California  emissions  standards  for  small  utiliy  engines,  which  have  generated  (at  last)  some 
interest  in  efficiency  and  hence  in  four-stroke  design.  Ryobi  (Phoenix)  has  been  the  first  to 
respond,  with  a  26  cc  “weed-wacker”  four-stroke;  it  is  for  this  engine  that  Walbro’s  carburet¬ 
tor  (WT-332)  was  designed.  Although  the  Ryobi  engine  is  bigger  (and,  incidentally,  heavier) 
than  the  Enya,  the  carburettor  can  be  adapted  without  much  difficulty. 

3.  Mixture  control 

We  replace  the  carburettor's  low-  and  high-speed  needle  valves  to  improve  sensitivity,  and 
fit  a  servo  and  linkage  so  that  adjustment  can  be  done  by  the  flight  computer.  At  present 
mixture  is  scheduled  open-loop  as  a  function  of  throttle  position.  This  is  acceptable  for  flight 
operations  planned  over  the  next  year,  but  we  intend  eventually  to  implement  a  closed-loop 
scheme  with  feedback  of  exhaust  O2,  exhaust-gas  temperature,  or  engine  speed. 

4.  Fuel  pump 

Fuel  delivery  and  pressure  regulation  in  the  Walbro  carburettor  is  via  an  integral  diaphragm 
pump  driven  by  crankcase  pressure.  We  install  a  crankcase  port  for  the  pump  just  below  the 
cylinder  barrel. 
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5.  Lubrication 

The  Enya  engine  is  designed  to  have  oil  introduced  with  fuel,  but  this  method  of  lubrication 
is  rather  profligate  and  hence  not  attractive  for  our  application.  Instead  we  fit  a  separate 
oil  circuit.  It  is  a  wet-sump  (“splash”)  scheme,  with  oil  introduced  to  the  crankcase  via  new 
ports  fore  and  aft  of  the  front  crankshaft  bearing,  and  drained  from  a  third  port  at  the  back 
of  the  engine.  Crankcase  vacuum  draws  oil  through  check  valves  to  the  inlet  ports,  and  a 
vibration-driven  pump  circulates  it  back  to  a  reservoir  in  the  aerosonde’s  mid-bay. 

6.  Compression  ratio 

Our  first  engine  was  modified  to  increase  compression  ratio  firom  the  standard  8.0  to  10.1. 
Relative  to  the  unmodified  engine  this  produced  a  smaller  performance  improvement  than 
was  expected  on  thermodynamic  grounds  (c/.  figures  4,  5),  and  additional  modifications  are 
necessary  (i.e.  in  valving)  to  realise  the  engine’s  full  potential.  Work  in  this  direction  will 
proceed  during  1995. 

7.  Reverse  rotation 

The  aerosonde  uses  an  off-the-shelf  model  propellor  which  is  right-handed.  The  Enya  must  be 
reversed  from  its  normal  rotation  in  order  to  use  a  right-handed  propellor  in  the  aerosonde ’s 
direct-drive  pusher  layout.  This  is  quite  easy  to  do  since  the  Enya  has  separate  intake  and 
exhaust  camshafts;  in  fact  this  feature  led  us  to  choose  the  Enya  over  other  model-aircraft 
four-strokes. 


2.2  Engine  performance 

Our  modifications  have  been  developed  through  an  ongoing  program  of  design  iteration  and  testing 
on  a  bench  dynamometer  (figure  3).  The  dyno  is  instrumented  for  engine  speed,  mean  torque,  fuel 
consumption,  manifold  vacuum,  and  ambient-,  cylinder-head,  and  exhaust-gas  temperature.  A  PC 
is  used  for  data  acquisition,  analysis,  and  engine  control.  A  propellor  is  used  as  the  load. 

Dynamometer  data  for  our  two  test  engines  are  shown  in  figures  4  and  5.  Both  engines  have 
fuel  consumptions  of  about  300  gm/kWh  at  full  power,  which  is  quite  substantially  better  than 
the  figure  of  450  gm/kWh  in  our  published  specification  (table  1).  Hence  there  is  some  prospect  of 
exceeding  our  targets  for  range  and  endurance.  However  the  fuel  consumption  is  higher  (in  power- 
specific  terms)  at  part  throttle;  consequently  minimum  fuel  consumption  can  be  realised  in  practice 
only  if  the  engine  is  run  in  a  burst-off  cycle.  While  this  would  be  acceptable  (even  advantageous) 
for  many  data-gathering  missions,  it  would  also  require  provision  for  in-flight  restart;  we  will  not 
add  that  feature  until  later  in  the  program.  Hence  at  present  we  can  only  idle  the  engine  as  an 
alternative  to  in-flight  shutdown.  We  discuss  the  consequences  for  range  and  endurance  in  §2.4. 

A  further  constraint  is  that  mixture  control  with  the  current  carburettor  and  control  strategy  is 
somewhate  erratic,  and  to  be  safe  we  consequently  have  to  fly  with  somewhat  higher  fuel  flow  rates 
than  can  be  maintained  on  the  dynamometer  (figure  5).  Much  of  the  problem  is  due  to  uneven 
fuel  vaporisation,  which  can  be  improved  by  raising  the  intake-air  temperature;  consequently  we 
are  now  working  on  an  exhaust  heat-muff.  Closed-loop  mixture  control  will  also  be  an  important 
addition. 

We  have  recently  proposed  a  program  of  engine  improvements  to  DoE  [11].  The  program  in¬ 
cludes  carburetion  refinement,  closed-loop  control,  higher  compression,  revised  valving,  and  geared 
propellor  drive.  We  can  look  forward  to  this  effort  delivering  better  performance  in  due  course, 
but  what  we  have  in  hand  is  quite  adequate  for  field  trials  planned  in  1995. 
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Figure  3:  Gasoline-fuelled  Enya  R120  running  on  the  bench  dynamometer.  The  dynamometer 
measures  torque,  speed,  fuel  consumption,  and  temperatures,  which  are  acquired  by  the  PC  at 
right.  This  view  is  from  the  front  of  Insitu’s  schoolbus,  which  has  been  fitted  as  a  mobile  workshop. 
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Figure  4:  Performance  of  Insitu’s  modified  Enya  R120  #1,  as  measured  with  an  APC  20-10 
propellor  on  the  bench  dynamometer.  The  upper  plots  show  power  and  fuel  mass  flow;  lower  plots 
show  power-specific  fuel  consumption.  Spark  advance  is  23“ . 
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2*3  Electrical  power 

The  aerosonde’s  average  electrical  load  over  a  long-duration  flight  will  average  between  10  and 
20  W.  The  aircraft  has  an  engine-driven  generator  for  the  base  requirement,  and  a  battery  with 
about  15  minutes  capacity  for  transients.^ .  The  electrical  load  takes  a  big  bite  out  of  aircraft  range, 
as  we  can  demonstrate  with  a  variation  on  the  classical  Breguet  range  equation.  Define 


c  specific  fuel  consumption 

D  aircraft  drag 

Pe  engine  shaft  power 

Pge  electrical  power  output  by  the  generator 
Pgm  shaft  power  input  to  the  generator 
R  range 

V  airspeed 

W  aircraft  weight 

Wto  weight  at  take-off 

We  weight  at  landing 

TjG  generator  drive  efficiency 

propellor  efficiency 

T/e  range  reduction  due  to  electrical  generation 
Then  the  power  required  of  the  engine  is 


Pe  = 


+  p 

Vp  '"PgeVG 

Z_E-  +  p 

rip  LID  P,e  na 


Fuel  consumption  is 

dW 

dt 

Combining  these  and  rearranging  gives 


—qcPe 


Vp  P  —  ^  ( 1  Ji.  ^  ^3^  Pgm  Vp  \  ,Tf 
gcD  W  \  DWV  Pge  VgJ 


(1) 

(2) 

(3) 


Integrating,  and  putting  the  result  in  the  standard  range-equation  form,  leaves 

(4) 

where 

I  /  L  Pge  Pgm  Vp  \  /c\ 

\Dwv7r,VGl  ' ' 

“<  >”  indicates  an  appropriate  average  over  the  flight.  We  needn’t  worry  about  the  details  of 
averaging,  since  our  point  can  be  made  with  rough  numbers.  For  the  current  eierosonde  design  (c/. 

^  We  are  occasionally  £isked  about  batteries  or  solar  as  alternatives,  but  each  is  a  non-starter.  A  battery  with 
capacity  for  3  days  at  20  W  would  weigh  more  than  an  aerosonde.  Solar  is  excluded  because  an  aerosonde  must 
operate  at  night  and  under  overcast. 
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Table  1) 


L/D 

ft! 

18 

20  W 

<W> 

100  N 

<v> 

20  m/i 

P gm/ P ge 

1.7 

Vp 

0.7 

VG 

0.9 

Then 

rje  »  0.81 

Thus  we  have  a  “direct”  range  penalty  of  about  20%  due  to  a  20  W  electrical  load.  Adding  the 
“indirect”  effect  due  to  displacement  of  fuel  by  the  weight  of  generator,  drive,  and  battery  makes 
the  overall  penalty  about  1.5%  per  watt,  which  is  sufficiently  large  to  make  the  electrical  system 
the  focus  of  considerable  engineering  effort.  One  basic  and  ongoing  priority  is  to  minimise  the 
electrical  requirement,  but  design  of  the  generator  and  drive  train  is  equally  important. 

We  have  tested  a  number  of  DC  motors,  both  brushed  and  brushless,  for  use  as  generators. 
The  best  has  proved  to  be  a  relatively  inexpensive  model-car  motor  (Epic  5.0),  and  its  performance 
map  is  plotted  in  figure  6.  We  use  it  with  modifications  as  follows: 

1.  Brushless  operation 

The  standard  motor  has  a  brushed  armature,  which  is  both  a  failure  point  and  a  significant 
contributor  to  friction.  We  remove  the  brushes  and  connect  to  the  armature  directly.  The 
engine  spins  the  motor  housing  (via  a  2.2:1  belt  drive)  while  the  armature  is  held  stationary. 
This  generates  3-phase  AC,  which  is  rectified  by  the  aerosonde’s  power  system. 

2.  Rewinding 

Switching  regulators  in  the  power  system  require  input  between  14  V  and  30  V.  To  match 
this  requirement  we  have  to  rewind  the  armature,  increasing  the  motor  constant  threefold  to 
3.5  V/Krpm. 

3.  Regulation  circuitry 

The  allowable  range  of  input  voltage  for  the  switching  regulators  is  about  2:1,  whereas  the 
generator  output  range  is  more  thaji  3:1  over  all  possible  in-flight  loads  and  engine  speeds.  To 
cope  with  this  we  wind  the  armature  in  an  electrical  “Y” .  At  low  armature  voltage  the  3-phase 
rectification  is  done  between  pairs  of  “Y”  arms,  while  at  high  voltage  it  is  done  between  each 
arm  and  the  centre  tap.  (Unfortunately  this  entails  an  efficiency  penalty  relative  to  figure  6, 
since  ohmic  losses  are  increased  at  high  speed.) 

These  arrangements  have  produced  an  adequate  solution,  but  certainly  not  an  optimal  one.  We 
have  explored  various  other  options,  including  some  exotica:  an  exhaust-driven  generator,  or  a 
thermoelectric  pile  generating  power  from  the  engine’s  waste  heat.  (The  latter  is  technically 
attractive  but  prohibitively  expensive;  we  estimated  more  than  $1000  per  aircraft.)  Perhaps  the 
best  alternative  is  a  “pancake”  generator  mounted  directly  on  the  crankshaft,  with  radial  windings 
and  a  stationary  axial  field  (as  opposed  to  axial  windings  and  a  spinning  radial  field  in  the  current 
generator).  Keeping  the  field  stationary  would  substantially  reduce  magnetic-hysterisis  losses, 
which  cause  much  of  the  drop  in  efficiency  at  high  speed  in  figure  6. 
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Figure  6:  Mechanical  power  absorbed  by  an  Epic  5.0  DC  generator  as  a  function  of  speed  and 
electrical  output.  For  any  specified  power  level  there  is  a  well-defined  optimum  speed.  At  lower 
speeds  the  EMF  drops,  so  current  must  rise  to  maintain  the  specified  electrical  output,  and  ohmic 
(i^iE)  losses  rise  steeply.  At  higher  speeds  “viscous”  losses  rise,  somewhat  more  gradually,  primarily 
because  of  eddy  currents  in  the  motor’s  magnetic  circuit.  The  higher  the  output  power,  the  higher 
the  optimum  speed. 
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2.4  Operating  protocol 

We  mentioned  eau-liet  that  the  aerosonde  engine  delivers  minimum  fuel  consumption  only  when 
operated  near  peak  power  (figure  5).  In  this  respect  it  is  no  different  from  larger  aircraft  engines, 
which  suffer  pumping  losses  when  throttled.  However  it  does  differ  from  the  norm  in  that  its 
peak  power  is  a  relatively  large  multiple  of  cruise  power  -  about  threefold  larger,  rather  than 
the  more  typical  value  of  about  1.5.  (Roughly  speaking  this  is  because  the  engine  must  be  sized 
for  climb,  which  means  that  peak  power  is  dictated  by  gross  weight;  meanwhile  cruise  power  is 
dictated  by  drag,  and  the  aerosonde,  being  designed  with  emphasis  on  aerodynamic  efficiency, 
has  a  relatively  low  drag-to-weight  ratio.)  Steady  cruising  consequently  would  entail  closing  the 
throttle  and  running  at  high  SFC.  But  one  can  avoid  this  problem  by  running  in  bursts,  and  so 
alternating  between  climb  and  descent.  Issues  then  arise  with  respect  to  operating  protocol  and 
electrical  generation.  Figure  7  illustrates  the  options. 

Case  A  is  the  (unattainable)  best  case,  with  no  generator  load  and  the  engine  shut  down  for 
descent.  (A  variable-pitch  propellor  could  spin  the  engine  for  restart.)  In  that  case  the  effective 
SFC  is  just  the  SFC  during  climb,  which  i^  minimised  by  climbing  at  peak  power.  This  produces 
a  cycle  in  which  the  engine  is  running  for  about  a  quarter  of  the  time  (more  when  the  aircraft  is 
at  gross  weight,  and  less  when  fuel  is  burned  off). 

Case  R  is  a  second  calculation  done  with  zero  generator  load.  However  it  shows  the  first-order 
consequence  of  adding  a  generator  to  the  engine  -  namely,  that  the  engine  cannot  be  shut  down  for 
descent.  Instead  one  is  forced  to  idle  to  keep  the  generator  running,  and  this  exacts  a  substantial 
range  penalty.  Idling  furthermore  reduces  the  advantage  to  be  gained  from  a  short-duty-cycle 
climb,  since  a  faster  and  more  efficient  climb  is  balanced  agciinst  more  fuel  wastage  during  descent. 

Cases  C  and  D  include  the  generator  load.  In  case  D  we  calculate  the  load  using  figure  6  and 
a  4:1  gear-up  from  the  engine  to  the  generator,  with  the  gearing  efficiency  presumed  to  be  0.9.  In 
case  C  we  specify  that  the  generator  runs  always  at  the  optimum  speed  for  a  20  W  load.  (We 
have  done  preliminary  design  of  a  two-speed  automatic  transmission  for  this  purpose,  although 
considering  the  additional  complexity  its  merits  are  open  to  debate.) 

The  difference  between  cases  B  and  Cis  about  20%,  as  we  calculated  in  the  rough  range  analysis 
(5).  However  this  comes  on  top  of  the  larger  A  — *  B  penalty  due  to  idling.  The  idling  penalty 
might  be  eliminated  by  driving  the  generator  with  a  separate  windmill,  and  we  have  shown  an 
estimate  for  this  option  as  case  E.  The  efficiency  of  this  drive  is  poor  since  it  involves,  in  effect, 
power  transmission  via  two  propellors  in  series;  furthermore  we  must  add  to  the  transmission  loss 
the  drag  of  a  generator  pod  and  mount.  Yet  accepting  all  of  that  for  the  sake  of  an  engine-off 
descent  is  an  option  well  worth  considering.  Our  rough  estimate  suggests  a  20%  range  improvement 
by  using  a  windmill  instead  of  an  engine  drive,  but  we  must  do  more  idling  and  windmill-efficiency 
analysis  before  we  can  draw  a  definitive  conclusion. 

Two  additional  possibilities  come  readily  to  mind:  the  first  is  to  run  on  batteries  during  descent, 
and  recharge  during  climb;  the  second  is  to  use  the  windmill  only  during  descent,  and  switch  to 
an  engine  drive  for  climb.  Unfortunately  each  of  these  options  offers  benefits  which  accrue  with 
increasing  time  spent  in  climb,  but  it  is  only  by  a  short  climb  cycle  that  one  can  realise  minimum 
SFC.  Hence  (although  some  calculations  are  in  order)  the  battery  option  is  probably  a  non-starter. 
The  windmill-and-engine-drive  option  (suggested  in  [6])  might  be  worthwhile  if  the  transmission 
cam  be  made  sufficiently  light  amd  efficient,  but  not  to  the  extent  of  producing  a  really  substantial 
improvement  over  catse  E. 

In  any  case  our  main  interest  at  present  is  less  with  optimisation  than  with  simplicity  and 
fast  development.  Consequently  we  are  planning  burst/idle  operation  with  a  single-ratio  generator 
drive  -  i.e.  case  D.  While  this  approach  is  cast  by  figure  7  as  the  worst  option,  it  is  still  good 
enough  for  flight  testing.  It  is  also  good  enough  for  MCTEX  field  trials.  However  after  analysis  of 
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Figure  7:  Estimates  of  effective  specific  fuel  consumption  c/t;^  with  various  climb/descent  operating 
protocols.  Mean  flight  power  is  taken  to  be  158  W  (100  N  gross  weight;  18.5  LID\  20  m/s  airspeed; 
and  70%  propellor  efficiency)  and  propellor  loads  axe  calculated  for  an  APC  20-10.  Fuel  flow  is 
estimated  from  static  tests  on  Insitu ^s  dynamometer.  (A)  engine  off  for  descent;  zero  electrical 
power.  (B)  engine  idling  for  descent  (30  gm/hr  fuel  flow  with  zero  propellor  thrust);  zero  electrical 
power,  (C)  idling  descent;  generator  always  driven  at  optimum  speed.  (D)  idling  descent;  4:1  gear- 
up  from  engine  to  generator.  (E)  engine  off  for  descent;  generator  driven  by  a  windmill.  Triangles 
show  generator  loads  at  idle. 
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Table  3:  Components  of  1994-96  and  follow-on  aerosonde  avionics  sets 
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flight  data,  as  well  as  further  design  and  testing  of  the  windmill/shutdown  option,  we  may  switch 
to  that  approach  later  in  the  program. 

3  Avionics 

Figure  8  is  a  block  diagram  of  the  avionics  set  that  was  designed  and  built  during  the  Phase  I 
period.  Table  3  gives  the  corresponding  list  of  major  components,  including  weights  and  power 
requirements.  (It  also  includes  a  tentative  list  for  a  follow-on  set  which  should  be  available  in 
1996-97).  Details  are  given  in  the  Avionics  Specification  [7]. 

The  avionics  are  built  around  a  68332-based  computer  made  by  Onset  (Pocasett,  Masachusetts). 
We  build  custom  circuitry  for  power  supply  and  interfacing  to  digital  and  analog  devices,  which 
are  shown  around  the  periphery  of  figure  8. 

In  the  upper  left  of  the  figure  we  have  24  analog  inputs  from  various  ‘‘engineering”  sensors,  of 
which  we  use  13  at  present  and  have  reservations  for  another  6.  Proceeding  clockwise  round  the 
diagram,  we  show  asynchronous  serial  interfaces  in  the  upper  right.  The  68332  has  one  on-chip 
UART  which  we  dedicate  to  debugging,  and  we  add  an  off-chip  UART  (Philips  26C198)  with 
8  more  bidirectional  serial  ports  (plus  32  bit-addressable  I/O  pins).  Of  these  UART  ports  we 
currently  use  two,  one  for  the  line-of-sight  radio,  and  one  for  the  GPS.  Two  more  may  be  used  for 
dual  thermodynamics-sensor  packages,  although  this  interface  has  not  yet  been  decided.  Another 
is  reserved  for  a  satellite-messaging  terminal,  which  we  plan  to  add  for  long-range  field  trials  in 
1996  (funds  permitting).  This  will  still  leave  room  for  expansion,  e,g.  with  a  second  computer. 

Proceeding  further  around  figure  8  we  have  shown  a  few  bit-toggled  devices;  of  these  only  the 
acquisition  lights  will  be  fitted  immediately. 

The  bottom  of  the  diagram  shows  peripherals  interfaced  via  the  68332  Time  Processor  Unit, 
which  is  an  on-chip  multimode  processor  for  generating  and  measuring  time- varying  waveforms. 
All  of  the  flight  controls  are  operated  through  this  interface.  The  actuators  are  standard  model- 
aircraft  servoes  and  are  commanded  by  pulse- width  modulation.  The  TPU  also  controls  the  engine 
ignition  through  a  deadman’s  switch.  The  switch  must  be  refreshed  continually  to  keep  the  engine 
running;  thus  it  will  stop  the  engine  in  the  event  of  hardware  or  software  failure. 

3.1  Line-of-sight  modem 

CRI-400  series  radios  made  by  Loral  Conic  (San  Diego)  ares  used  in  both  the  avionics  and  ground 
station.  These  offer  9600  baud  with  up  to  5W  RF  power  in  the  400  MHz  band.  We  calculate  the 
RF  output  to  be  sufficient  to  meet  our  requirement  of  100  km  line-of-sight  range  for  1995  field 
trials.  Frequency  can  be  changed  on  the  fly  over  a  6  MHz  band,  so  that  we  can  implement  a 
protocol  for  channel  hopping  in  the  event  of  interference  (attachment  3),  The  aircraft  has  a  dipole 
antenna  inside  one  of  tailplanes  (which  is  built  as  a  fibreglass  shell). 

These  radios  are  a  major  departure  from  the  prototype  system,  in  which  we  used  low-power 
spread-spectrum  modems  made  for  a  wireless  ethernet.  The  key  difference  is  that  the  new  radios  are 
half-duplex.  This  has  led  to  a  great  deal  of  work  on  protocols  to  handle  both  normal  communications 
(attachment  2)  and  failure  recovery  (attachment  3). 


4  Software 

When  we  began  design  of  the  “operational”  version  of  the  aerosonde,  we  had  already  developed 
quite  a  substantial  body  of  software  for  the  prototype  aircraft.  This  included  independent  autopi¬ 
lots  for  airspeed,  altitude,  turn  rate,  and  mixture  control;  an  outer  loop  for  great-circle  course 
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Figure  9:  Ground  control  architecture.  For  take-off  and  lauiding  the  aerosonde  is  controlled  man¬ 
ually  from  the  pilot’s  console,  which  is  essentially  the  same  as  those  used  for  model  aircraft. 
Autopilot  loops  axe  enabled  once  the  aircraft  is  clear  of  local  obstacles.  The  ground  station  con¬ 
trols  autopilot  modes  and  monitors  2urcraft  status.  Telemetry  is  routed  through  a  “switchboard” 
computer,  which  is  a  stripped-down  version  of  the  computer  used  onboard.  It  manages  a  half¬ 
duplex  communications  protocol  with  the  aircraft.  Aircraft  control  is  maintained  in  the  event  of 
failure  of  either  the  pilot’s  console  or  the  PC  (or  indeed  of  the  whole  ground  station,  in  which  case 
the  aircraft  continues  to  execute  its  flight  plan  autonomously). 
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tracking;  and  provision  for  direct  or  stability- augmented  manual  control  of  any  selected  aircraft 
axes.  Details  of  the  autopilot  design  are  given  by  McGeer  [9]  and  the  various  modes  are  described 
in  attachment  1.  Continuous  full-duplex  communication  was  maintained  with  the  ground  sta¬ 
tion,  which  provided  tabular  and  graphical  data  display,  anomaly  alerting,  autopilot  mode  control, 
flight-plan  editing,  downlink  logging,  and  replay. 

In  moving  to  the  new  aircraft  there  was  no  need  for  more  functionality,  but  nevertheless  a  great 
deal  of  new  software  has  been  required.  There  have  been  four  main  areas  of  work: 

1.  “Low-lever  functions  for  the  new  hardware  (particularly  for  the  Philips  UART,  which  is  a 
new  and  relatively  complex  chip); 

2.  Half-duplex  communications  protocols  (attachments  2,  3); 

3.  Implementation  of  a  new  ground  architecture  (figure  9)  whereby  communications  are  routed 
through  a  “switchboard”  computer; 

4.  Hardware-in-loop  simulation. 

The  last  two  of  these  items  are  consequences  of  a  basic  change  in  flight-control  paths.  Manual 
control  for  the  prototype  vas  exercised  via  a  hobbyist-type  radio  controller  (R/ C)  independent  of 
the  ground  PC  and  data  link.  The  design  was  such  that  in  the  event  of  failure  of  the  flight  computer, 
control  would  revert  to  the  manual  channel.  This  arrangement  allowed  us  to  compromise  somewhat 
on  elaborate  pre-flight  avionics  qualification,  since  we  could  tolerate  in-flight  failures.  (And  on 
one  occasion  we  did  in  fact  have  an  in-flight  failure,  due  to  an  intermittent  power  connector.) 
However  in  practice  the  R/C  system  proved  to  be  a  weak  link,  and  R/C  failure  led  to  loss  of  the 
third  prototype  aerosonde  (and  our  only  avionics  set)  in  April  1994.  Our  first  Phase  I  progress 
report  [13]  reviewed  this  failure  in  detail. 

In  the  new  avionics  the  R/C  system  (which  was  always  regarded  as  a  short-term  expedient) 
is  eliminated,  but  as  a  consequence  we  are  completely  reliant  upon  the  flight  computer  and  its 
softwaxe.  We  are  also  completely  reliant  upon  a  single  communications  link  for  control  from  the 
ground.  Very  thorough  testing  by  hardware-in-loop  simulation  has  therefore  become  mandatory, 
as  has  a  robust  ground  architecture.  Prior  to  first  flight  we  want  to  have  high  confidence  that 

1.  software  bugs  have  been  eliminated  from  flight  and  ground  computers; 

2.  flight  and  “switchboard”  computers  will  reset  safely  in  the  event  of  software  exceptions  or 
“crash”  bugs; 

3.  hardware  weaknesses  have  been  exposed  and  corrected; 

4.  in  the  event  of  failure  of  either  the  manual-  or  supervisory-control  branches  in  the  ground 
system,  the  other  branch  will  continue  to  function  (attachment  1); 

5.  in  the  event  of  communications  failure,  the  aircraft  will  maintain  safe  autonomous  operation 
(attachment  1); 

6.  in  the  event  of  onboard  hardware  or  uncorrected  software  failure,  the  aircraft  will  come  down 
in  a  limited  area  (by  activating  the  deadman’s  ignition  switch). 

This  effort  has  continued  beyond  the  Phase  I  period,  and  is  expected  to  be  sufficiently  complete 
for  a  first  flight  with  avionics  in  April. 
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5  Hardware-in-loop  simulation 

Development  of  the  aerosonde  simulator  was  begun  in  summer  1994.  By  January  it  was  fully 
functional,  including  complete  (z.e.  nonlinear)  rigid-body  dynamics,  first-order  engine  dynamics, 
and  a  nonlinear  aerodynamic  model  (which  is  accurate  for  small  angles,  and  at  least  adequate 
for  large  angles).  It  also  includes  fuel-slosh  dynamics  for  a  large  integral  tank  originally  intended 
for  the  mid-fuselage  bay;  however  the  slosh  issue  has  been  substantially  eliminated  by  going  to 
a  bladder  tank,  so  this  model  is  not  used.  The  full  set  of  models  and  calculation  procedures  is 
specified  by  McGeer  [5].  Executable  is  841KB. 

The  simulator  has  three  operating  modes,  as  follows: 

1.  Software  checkout 

The  simulator  includes  key  parts  of  the  flight-control  code,  and  much  of  the  supervisory  code 
from  the  ground-station  PC.  These  can  be  coupled  with  the  dynamics  integration,  and  the 
software  thus  exercised  independent  of  hardware. 

2.  Hardware-in-loop 

In  hardware-in-loop  simulation,  the  flight  computer  operates  just  as  in  flight.  It  drives  a 
set  of  servoes;  their  positions  are  read  continuously  by  the  simulator;  the  dynamics  model  is 
integrated  in  real  time;  and  signals  simulating  the  primary  control  sensors  are  returned  to 
the  flight  computer.  These  include  the  pitot  pressure  sensor,  static  pressure  sensor,  yaw  rate 
gyro,  ambient  temperature  sensor,  tachometer-pulse  generator,  and  GPS. 

3.  Engine-in-loop 

Instead  of  calculating  an  engine  model,  the  simulator  can  measure  the  speed  of  the  real 
engine  running  on  the  aircraft.  It  can  then  use  this  measurement  (plus  the  positions  of  the 
aileron,  elevator,  rudder,  and  flap  servoes)  as  input  to  the  flight  dynamics  simulation,  and 
again  returns  synthetic  sensor  signals  to  the  onboard  computer.  This  mode  allows  practically 
complete  realism  in  exercising  all  ground  and  onboard  systems,  as  well  as  the  crew. 

The  simulator  is  the  ultimate  tool  for  verifying  the  conditions  for  first  flight  enumerated  in  §4. 
Check-out  in  software  mode  was  done  in  January,  and  testing  in  the  two  hardware  modes  is 
proceeding  toward  our  April  flight  target. 


6  Outlook 

For  a  technical  point  of  view  we  consider  the  aerosonde  program  to  be  in  good  order.  We  have 
identified  all  of  the  necessary  elements;  we  have  good  quantitiative  knowledge  of  their  performance, 
and  corresponding  confidence  in  the  aircraft  specification;  and  we  have  a  clear  idea  of  what  has  to 
be  done  to  get  aerosondes  into  the  field.  Work  on  the  new  version  of  the  aircraft  has  taken  longer 
than  expected,  and  kept  our  small  group  very  hard-pressed.  However  this  effort  has  produced  a 
good  system,  and  we  are  moving  systematically  toward  first  flight.  With  the  resources  currently 
in  hand  we  will  continue  to  be  hard-pressed  to  be  ready  for  MCTEX  field  trials  in  November,  but 
we  think  that  our  chances  are  reasonable. 

When  we  extend  our  outlook  to  the  long  term  we  can  be  very  confident  indeed.  The  need  for 
in  situ  information  is  evident;  the  system  to  use  it  is  primed  and  waiting;  its  value  is  well  known. 
The  aerosonde  is  distinctive,  and  perhaps  even  unique,  in  its  promise  to  deliver  such  information, 
in  volume,  at  a  cost  that  is  not  only  economically  justifiable  but  also  fiscally  practicable.  There  is 
some  risk,  but  the  probability  of  success  is  high,  and  the  rewards  of  success  would  be  great.  Hence 
we  expect  that  the  aerosonde  will  attract  support  for  vigorous  development,  and  that  its  potential 
will  be  well  established  before  the  end  of  the  decade. 
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7  Staff 

The  Insitu  Group  has  a  staff  of  four  devoted  to  aerosonde  development,  as  follows: 

L  Tad  McGeer  (PhD  Aeronautics  and  Astronautics,  Stanford  1984)  is  president  of 
The  Insitu  Group,  and  has  been  concentrating  on  aerosonde  development  since  first  proposing 
the  concept  in  1991.  This  followed  advanced  design  work  on  the  Perseus  series  of  autonomous 
aircraft  in  1990-91,  while  serving  as  Chief  Scientist  of  Aurora  Flight  Sciences  (Manassas, 
Virginia).  Before  1990  he  was  on  the  Engineering  Science  faculty  at  Simon  Fraser  University 
in  British  Columbia,  where  his  work  included  legged  robots  and  autonomous  submersibles. 

2.  Ross  Hoag  (BSEE,  Montana  State  1989)  is  Insitu's  lead  electronics  engineer,  with  prime 
responsibility  for  avionics  development.  He  is  thoroughly  experienced  in  electronic  systems 
from  specification  to  test  and  demonstration,  with  particular  emphasis  on  high-speed  design 
and  packaging  for  reliability  and  light  weight.  Mr  Hoag  has  come  to  the  project  from  work  on 
instrument  landing  systems  with  Advanced  Navigation  (Hood  River,  Oregon)  and  programs 
at  Tektronix  on  electronic  test  equipment. 

3.  Kurt  Ziegler  (BSEE,  Kansas  State  1984)  is  Insitu’s  lead  software  engineer.  He  also 
came  to  the  project  from  ILS  work  at  Advanced  Navigation,  where  he  was  involved  with 
flight  test  as  well  as  electronics  and  software  development.  His  experience  includes  several 
years  as  Principal  Engineer  on  TCAS  development  with  Honeywell. 

4.  Clifford  Jackson  is  Insitu’s  pilot  and  airframe/powerplant  technician.  He  is  a  top-ranked 
competitor  in  model  aerobatics,  and  has  been  involved  with  model  aircraft  and  the  supporting 
industry  for  25  years.  His  knowledge  of  modelling  techniques  is  vital  in  making  economical 
and  proven  engineering  choices  in  many  areas  of  aerosonde  design. 

We  also  draw  upon  the  expertise  of  Hood  Technology  Corporation  (Hood  River,  Oregon),  a  small 
firm  foimded  in  1992  by  Dr  Andy  von  Flotow.  Drs  McGeer  and  von  Flotow  have  been  colleagues 
since  doctoral  work  at  Stanford  in  the  early  1980s.  Dr  von  Flotow  was  Associate  Professor  of  Aero¬ 
nautics  and  Astronautics  at  MIT  for  several  years,  where  his  research  encompassed  dynamics  and 
control  of  spacecraft  and  electromechanical  systems.  Since  moving  to  Oregon  his  group  specialises 
in  designing,  building,  and  testing  prototype  products  for  active  control  of  sound  and  vibration. 

The  Australian  Bureau  of  Meteorology  has  also  been  closely  involved  in  the  aerosonde  program 
since  its  inception.  Its  work  includes  meteorological  instrumentation,  applications  planning,  and 
very  active  promotion  of  the  concept.  BoM  activities  are  directed  by  Greg  Holland  (PhD  Atmo¬ 
spheric  Science,  Colorado  State  1983)  as  leader  of  the  Mesoscale  Meteorology  Research  Group. 
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REVIEW  OF  FLIGHT  CONTROL  MODES 

The  aerosonde  currently  has  five  autopilot  loops  as  follows: 

1 .  dynamic  pressure  (i.e.  indicated  airspeed),  controlled  by  elevator 

2.  yaw  rate,  controlled  by  aileron  and  rudder 

3.  static  pressure  {i.e.  barometric  altitude)  or  pressure  rate  (i.e.  vertical  speed),  controlled 
by  throttle 

4.  engine  rpm,  controlled  by  throttle  (note  that  3  and  4  cannot  operate  simultaneously) 

5.  GPS  course  tracking,  running  as  an  outer  loop  issuing  commands  to  the  yaw  rate  loop 

Consider  the  airspeed  loop  as  an  example  to  explain  modes  of  operation.  If  the  loop  is 
disabled,  then  elevator  position  is  controlled  manually  from  the  pilot’s  console.  If  it  is 
enabled,  then  either  the  keyboard  or  the  pilot’s  console  can  be  selected  as  the  source  of  the 
airspeed  command.  From  the  keyboard,  the  desired  true  airspeed  is  simply  typed  into  the 
appropriate  I/O  table;  if  the  specified  value  is  considered  safe,  then  the  command  is  sent  to 
the  aircraft.  From  the  console,  the  pilot’s  “pitch”  input  commands  airspeed  rather  than 
elevator  position.  Moving  the  stick  forward  makes  the  aircraft  step  to  higher  speed.  The 
effect  is  to  give  the  pilot  “stability-augmented”  control  (SA).  This  is  also  available  on  the 
“roll”  input  (commanding  turn  rate)  and  the  “power”  input  (commanding  climb  rate). 
(Scaling  of  the  pilot’s  commands,  and  the  airspeed  corresponding  to  neutral  pitch  input, 
can  be  changed  from  the  keyboard.) 

The  accompanying  diagram  illustrates  the  various  sources  for  elevator  commands, 
followed  by  similar  diagrams  for  rudder/aileron,  throttle,  mixture,  and  flap. 

The  power  to  select  among  these  various  combinations  is,  of  necessity,  shared  among  the 
flight  computer  and  the  two  ground  computers.  The  sharing  of  powers  is  specified  below. 
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GLOBAL  AUTOPILOT  STATUS 

A  global  variable  affects  collective  enabling  of  all  autopilot  loops.  It  has  3  possible  values: 

1.0FF 

The  pilot’s  console  controls  all  servoes  directly,  except  that  throttle  throw  and  rate 

limiting  may  be  activated  from  the  keyboard. 

2.  ON 

Any  of  the  possible  control  paths  can  be  selected  from  the  keyboard  (including  manual 

command  for  each  servo,  in  which  case  the  pilot’s  control  is  the  same  as  if  the  global 

autopilot  status  were  OFF). 

3.  SAFE 

SAFE  status  is  expected  to  be  used  only  when  a  failure  occurs  somewhere  in  the  system. 

It  is  like  ON  except  for  two  points: 

1 .  When  SAFE  is  selected,  a  check  is  made  of  the  status  and  set  point  of  each  autopilot 
loop.  If  any  is  not  safe  then  a  new  value  is  set  (but  may  subsequently  be  changed  from 
the  keyboard). 

2.  The  pilot’s  console  controls  switching  between  ON  and  OFF,  the  idea  being  that  if  the 
pilot  sees  autopilot  behaviour  that  he  doesn’t  like,  then  he  can  immediately  switch  to 
manual  control.  When  SAFE,  on  the  other  hand,  the  pilot’s  switch  is  masked. 


1  RESPONSmiLlTYFORCHANGirS 

G  GLOBAL  AUTOPILOT  STATUS 

OFF->ON 

pilot  (gnd  TT8) 

ON  ^OFF 

pilot  (gnd  TT8) 

OFF  ^  SAFE 

kbd  (gnd  PC)  or  a/c 

SAFE -»  OFF 

disallowed 

ON  -^SAFE 

kbd  (^d  PC)  or  a/c 

SAFE ON 

kbd  (gnd  PC)* 

*  however  the  ground  TT8  will  set  status  from  SAFE  to  ON  if  its  link  to  the  ground 
PC  fails. 

1.  Ground  Tattletale 

Control  of  global  autopilot  status  normally  rests  with  the  ground  Tattletale.  Switching 
between  ON  and  OFF  is  commanded  by  the  pilot’s  “retracf’  switch,  which  sets  Ae  width 
of  one  pulse  in  a  regular  PPM  series.  The  ground  TT  checks  this  pulse  whenever  it  has 
not  been  notified  of  a  SAFE  status  by  either  the  flight  computer  or  the  ground  PC.  Thus 
if  the  last  reported  status  is  ON,  then  the  ground  TT  checks  whether  the  switch  pulse 
width  is  within  a  specified  small  tolerance  of  the  OFF  value.  If  so  it  uplinks  the  new 
status  to  the  the  flight  computer  (which,  when  communications  woric  properly, 
immediately  echoes  it  back  to  the  ground  PC).  Conversely  if  the  last  reported  status  if 
OFF,  then  it  is  switched  to  ON  if  the  switch  pulse  is  not  within  tolerance  of  the  OFF 
value. 

The  ground  TT  furthermore  monitors  all  autopilot-status  traffic  to  determine  whether  the 
flight  computer  expects  flight-control  commands  from  the  pilot’s  console.  Its  sends  these 
commands  whenever 
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1 .  global  status  is  OFF;  or 

2.  any  of  the  airspeed,  yaw  rate,  altitude,  mixture,  or  flap  (“glidepath”)  loops  is 
set  OFF  (MANUAL_SERVO_CMD)  or  SA  (MANUM._LOOP_CMD). 

Provision  for  the  ground  TT  to  change  status  from  SAFE  to  ON  is  made  for  one 
particularly  unusual  situation,  in  which  not  only  has  SAFE  been  set,  but  also  the  link  to 
the  PC  has  failed.  In  that  case  individual  loops  are  set  in  safe  configuration,  but  global 
status  is  set  either  ON  or  OFF  according  to  the  position  of  the  pilot’s  switch. 

2.  Flight  computer 

The  flight  computer  is  able  to  change  the  global  status  to  SAFE,  and  will  do  so  if,  and 
only  if,  either  (1)  no  uplink  traffic  is  received  within  a  specified  interval  (typically  10  sec); 
or  (2)  pilot  inputs  are  expected  but  not  received  within  a  specified  interval  (typically  400 
msec).  Upon  switching  to  SAFE,  the  flight  computer  will  furthermore  set  individual 
autopilot  loops  as  follows. 

1  Airspeed  loop  ON,  and  command  with  pitot  pressure  commanded  to  establish  a  safe 
lift  coefficient  at  the  estimated  aircraft  gross  weight.  A  typical  safe  Cl  would  be 
0.75,  which  at  12  kg  gross  weight  would  correspond  to  about  22  m/s  at  sea  level. 

2  Altitude  loop  ON 

3  If  the  last-commanded  flight  plan  segment  is  valid,  then 

3.1  it  will  set  the  altitude  command  to  the  maximum  for  that  segment 

3 .2  if  the  current  altitude  is  above  a  specified  minimum  for  tracking,  it  will  enable 
tracking  on  that  segment 

3.3  if  the  current  altitude  is  lower  than  the  specified  minimum,  it  will  command 
zero  yaw  rate,  and  set  a  flag  for  enabling  the  tracker  as  soon  as  the  altitude  is 
sufficient 

4  If  the  last  commanded  flight  plan  segment  is  not  valid,  then 

4. 1  if  the  current  altitude  is  above  the  tracking  minimum,  then  it  will  command  a 
shallow  turn 

4.2  if  not,  tiien  it  will  command  zero  yaw  rate,  and  set  a  flag  for  commanding  a 
shallow  turn  as  soon  as  the  altitude  is  sufficient. 

3.  Ground  PC 

The  ground  PC  is  able  to  set  autopilot  status  to  SAFE  imder  one  of  the  following 
anomalous  conditions: 

1 .  Upon  a  SAFE  command  from  the  keyboard  (presumably  because  the  flight  engineer 
has  decided  that  pilot  inputs  are  unacceptable); 

2.  Upon  detecting  communications  failure. 

In  either  case  individual  loops  are  put  into  to  their  safe  status,  and  notification  is  sent  to 
the  flight  computer.  The  keyboard  can  remove  SAFE  status  by  commanding  the  status  to 
ON 
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SETTING  FLIGHT  CONTROL  CHANNELS  FROM  THE  KEYBOARD 

The  status  of  each  control  channel  is  set  by  a  2-bit  wide  field  in  the  AP_Status  variable. 

The  least-significant  bit  (LOOP_ON_MASK)  indicates  whether  the  loop  is  on  or  off,  and 

the  most-significant-bit  (KBD_CMD_MASK)  indicates  whether  the  command  source  is  die 

keyboard  or  the  pilot’s  console.  These  bits  may  be  set  via  the  I/O  table  for  autopilot 

status.  Input  will  be  accepted  only  if  is  considered  safe  and  valid: 

1 .  servo  throws  must  be  between  0  and  1 

2.  true  airspeed  commands  must  correspond  to  a  safe  Cl  at  the  currently-calculated 
aircraft  weight  and  ambient  density,  (e.g.  0. 1 5  <  Cl  <  1 .0;  c/the  following  table) 

3 .  yaw  rate  magnitude  must  be  comfortably  less  than  g/V,  which  is  the  physical  limit  for  a 
coordinated  turn.  (Turn  rate  may  be  quite  large  at  large  bank  angle,  hut  yaw  rate 
asymptotes  to  this  value.)  Note  that  the  turn-rate  limit  is  calculated  using  the 
currently-commanded  true  airspeed. 

4.  rpm  must  be  within  reasonable  upper  and  lower  bounds 

5 .  altitude  must  be  no  lower  than  the  specified  minimum  tracking  altitude 


Elevator/airspeed 


to  control 

from 

set  AP_Status. pitot  to 

by  setting  airspeed 
field  to 

elevator 

MA1IUAL_SERV0_CMD 

“off’ 

MANUALLOOPCMD 

“sa” 

KBD_LOOP_CMD 

wmssmmm 

KBD  SERVO  CMD  is  invalid  1 

*  whenever  a  new  airspeed  is  commanded  from  the  keyboard,  new  autopilot  gains  are 
calculated  by  the  flight  computer  and  reported  to  the  ground  PC. 
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Aileron/rudder/yaw  rate 


to  control 

from 

set 

by  setting 
field 

to 

aileron/ 

rudder 

pilot’s 

console 

AP  Status. yaw  rate  = 
MANUALSERVOCMD 

AP  Status. track  = 
MANUAL  SERVO  CMD 

turn  rate 

“off” 

yaw  rate 

pilot’s 

console 

AP  Status. yaw  rate  = 
MANUALLOOPCMD 

AP  Status. track  = 
MANUAL  SERVO  CMD 

turn  rate 

“sa” 

yaw  rate 

keyboard 

AP  Status. yaw  rate  = 
KBD_LOOP_CMD 

AP  Status. track  = 
MANUAL  SERVO  CMD 

turn  rate 

desired  rate 
[deg/s] 

yaw  rate 

AP  Status. yaw  rate  = 
KBD_LOOP_CMD 

AP  Status. track  = 
KBD  LOOP  CMD 

track 

valid  FP  segment 
index 

1  other  combinations  are  invalid  | 

If  the  “track”  field  is  set  from  a  flight-plan  segment  number  to  “off’,  then  the  yaw-rate 


loop  remains  ON  and  set  for  a  shallow  turn 


Mixture 


to  control 

from 

set  AP_St:a'tus. mixture 
to 

by  setting  mixture 
field  to 

mixture 

pilot’s  console 

MANUAL_SERVO_CMD 

“off” 

mixture 

keyboard 

KBD_SERVO_CMD 

fiactional  throw 
(0  to  1) 

mixture 

throttle  sched 

KBDLOOPCMD 

“on” 

MANUAL  LOOP  CMD  is  invalid  | 

Flap/airbrake 


to  control 

from 

set 

AP  Sea-bus. glidepath  to 

by  setting  flap  field  to 

flap 

pilot’s  console 

MANUAL_SERVO_CMD 

“off” 

flap 

keyboard 

any  other  value 

fractional  servo  throw 
(0  to  1) 

If  the  airspeed  loop  is  ON,  and  AP_Status .  glidepath  MANUAL_SERV0_CMD, 
then  flaps  are  fully  extended  for  braking  whenever  pitot  pressure  exceeds  the  commanded 
value  by  a  specified  amount. 
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to  control 

from 

set 

by  setting 
Held 

to 

throttle 

pilot’s 

console 

AP  S-tatus .  Pstatic  = 
MANUAL_SERVO_CMD 

rpm, 

altitude,  and 

“off” 

AP  Status. rpm  = 
MANUAL  SERVO  CMD 

climb  rate 

throttle 

keyboard 

AP  Status. Pstatic  = 
MANUAL_SERVO_CMD 

rpm 

fractional  servo 
throw 

AP  Status. rpm  = 

KBD  SERVO  CMD 

(0  to  1) 

rpm 

keyboard 

AP  Status . Pstatic  = 
MANUAL_SERVO_CMD 

rpm 

desired  rpm 

AP  Status. r^  = 

KBD  LOOP  CMD 

static 

pressure 

pilot’s 

console 

AP  Status . Pstatic  = 
MANUAL_LOOP_CMD 

climb  rate 

“SA” 

rate 

AP  Status. rpm  = 
MANUAL  SERVO  CMD 

static 

pressure 

keyboard 

AP  Status . Pstatic  = 
KBD_LOOP_CMD 

climb  rate 

desired  rate  [m/s] 

rate 

AP  Status. rpm  = 
MANUAL  SERVO  CMD 

current 

static 

keyboard 

AP  Status. Pstatic  = 
KBD_LOOP_CMD 

climb  rate 

0 

pressure 

AP  Status. rpm  = 
MANUAL  SERVO  CMD 

selected 

static 

pressure 

keyboard 

AP  Status . Pstatic  = 
KBD_LOOP_CMD 

AP  Status. rpm  = 
MANUAL  SERVO  CMD 

altitude 

selected  altitude  [m], 
provided  that  flight- 
plan  tracking  is  OFF 

static 

pressure 

or 

pressure 

band 

flight  plan 

AP  Status . Pstatic  = 
KBDLOOPCMD 

AP  Status. rpm  = 
MANUAL_SERVO_CMD 

altitude 

or 

climb  rate 

any  valid  altitude 
[m] 
or 

any  valid  rate 
[m/s] 
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Safety_Limits  ON  AUTOPILOT  MODES 

Selection  of  autopilot  modes  and  target  values  is  regulated  according  to  variables  in  the 
Saf  ety_Limits  data  structure.  These  include  the  following. 


Safety  Limits  variables  involved  in  autopilot  selection 


structure  member 


max  CL  cmd 


min  CL  cmd 


safe  CL 


max  yaw  f r ac 


min  track  alt 


brake  dPitot  Pa 


Vl_pitot_Pa 


max_g 


link  msec 


Pcmd  msec 


gps_msec 


specifies 


Cl  at  minimum  commanded  airspeed 


Cl  at  maximum  commanded  airspeed 


Cl  for  SAFE  airspeed 


max /rc/ 


min  altitude  [m]  for  FP  tracking 


jq-q^  [Pa]  for  flap  extension 


min  q  for  airspeed  loop  execution* 


normal  acceleration  limit 


T  rmsec]  before  flagging  uplink  failure 


T  [msec]  before  flagging  manual- 
command  failure 


T  [msec]  before  flagging  GPS  failure** 


typical  value 


1.0 


0.15 


0.75 


0.4 


as  needed 


200  Pa 


100  Pa 


1.4 


10,000  msec 


400  msec 


10,000  msec 


*  If  the  airspeed  loop  is  ON  at  a  lower  pitot  pressure,  then  the  elevator  will  be  set  at 
neutral.  This  will  prevent  catastrophic  pitch-down  in  the  event  that  the  pitot  measurement 
fails  to  a  low  value. 

**  If  the  tracking  loop  is  ON  and  the  GPS  fix  has  not  been  updated  for  gps_msec , 
then  a  shallow  turn  will  be  commanded. 


AEROSONDE  HALF-DUPLEX  COMMUNICATIONS  PROTOCOLS 

Kurt  Ziegler 
30  March  1995 


Aerosonde  communications  are  exchanged  among  three  nodes:  the  ground  PC,  the  staging 
module,  and  the  aerosonde  flight  computer.  All  communications  are  in  packet  form.  Tlie 
protocol  provides  for  message  routing,  flow  control,  multiple-packet  burst  transmission, 
and  error  detection  using  the  Cyclic  Redundancy  Check  (CRC)  algorithm.  The  staging 
module  serves  as  the  network  controller,  maintaining  a  link  to  both  the  aerosonde  and  the 
ground  station,  and  managing  the  transfer  of  data  between  the  two.  In  addition,  the 
staging  module  accepts  manual-control  commands  from  the  pilot  console,  and  is 
responsible  for  uplinking  them  to  the  aerosonde  in  a  timely  fashion. 

Radio  link 

A  single  radio  frequency  is  available,  so  radio  exchanges  must  be  half-duplex.  A  state 
machine  maintains  a  half-duplex  protocol  as  illustrated  in  the  accompanying  figure. 
Communications  are  organized  into  200  msec  frames,  matching  the  period  of  the  autopilot 
loops  running  on  the  aerosonde.  Precise  UTC  is  kept  on  both  the  aerosonde  and  staging 
module  using  their  respective  GPSs,  and  this  provides  synchronization.  (In  tiie  event  of 
GPS  failure,  the  aerosonde  synchronizes  on  a  packet  sent  by  the  staging  module  at  the 
beginning  of  each  communication  frame.) 

Flow  control  is  signalled  by  a  type  assigned  to  each  packet,  which  affects  processing  by 
the  receiver.  A  communication  frame  always  begins  with  a  sync  packet  sent  by  the  staging 
module.  If  the  staging  module  has  additional  packets  queued  for  transmission,  then  the 
sync  packet  and  those  following  are  sent  with  type  PT  BDCST.  This  tells  the  aerosonde 
that  more  packets  are  on  the  way.  When  the  aerosonde  sees  a  packet  of  this  type  it  will 
not  respond  with  an  acknowledge,  but  instead  remain  in  the  receive  state. 

When  the  staging  module  either  empties  its  queue  or  determines  that  no  more  packets  will 
fit  in  the  current  finme,  it  sends  a  final  packet  with  type  PT  MULT.  This  tells  the 
aerosonde  to  begin  sending  to  the  staging  module.  The  aerosonde  determines  how  many 
pending  packets  will  fit  in  the  remainder  of  the  frame,  and  sends  the  group  in  a  burst. 

Each  packet  is  tagged  with  a  sequence  number,  with  the  last  packet  in  the  burst  given 
number  zero.  The  staging  module  interprets  this  packet  as  an  acknowledge,  indicating 
normal  termination  of  handshaking  for  flie  frame.  Depending  upon  how  the  downlink 
packets  are  addressed,  they  may  be  processed  by  the  staging  module  or  passed  on  to  the 
ground  PC. 

If  the  staging  module  determines  that  there  is  too  little  time  left  in  the  frame  for  a  multiple- 
packet  downlink,  it  can  send  a  packet  of  type  PT  RQST.  The  aerosonde  responds 
immediately  with  a  packet  of  type  PT  ACK,  which  terminates  the  handshaking. 


At  the  end  of  the  communication  frame,  after  the  handshaking  cycle  is  terminated,  the 
staging  module  samples  the  pilot  console  and  sends  manual-control  information  (which  the 
aerosonde  may  or  may  not  require)  in  a  packet  of  type  PT_BRDCST.  The  transmission  of 
this  packet  is  timed  to  coincide  with  the  beginning  of  the  flight-control  loop  on  the 
aerosonde,  thereby  minimizing  latencies  between  pilot  input  and  corresponding  servo 
movement.  The  manual-control  packet  is  sent  even  if  handshaking  is  not  terminated 
properly. 

A  guard  period  is  maintained  at  the  end  of  each  communication  frame.  During  this  period 
no  communication  is  initiated,  thus  providing  a  buffer  to  ensure  that  packet  transmission 
cannot  overrun  the  frame.  With  GPS  synchronization  the  guard  period  is  about  5  msec. 

Staging-FC  serial  link 

The  PC  and  staging  module  communicate  via  standard  full-duplex  RS-232.  No 
handshaking  is  required.  Packeting  is  identical  to  that  on  the  radio  link,  but  only  a  subset 
of  packet  types  is  used. 

Most  packets  initiated  by  the  ground  station  are  addressed  to  the  aerosonde.  The  ground 
station  can  send  packets  of  type  PT  BDCST,  which  permit  the  staging  module  flexibility 
in  queuing  the  packet,  or  of  type  PT  RQST,  which  force  a  strictly  acknowledged 
handshake  between  staging  and  aerosonde. 

The  ground  station  may  also  address  packets  to  the  staging  module.  The  only  packet 
currently  sent  is  an  “alive”  message  to  verify  that  the  link  is  in  working  order. 


Aerosonde  Serial  Network 
Normal  Synchronous  Communication 
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AEROSONDE  COMMUNCATIONS  FAILURE  AND  RECOVERY 

Tad  McGeer 
17  February  1995 


DETECTION 

Communications  failure  will  be  assumed  if  no  message  is  received  within  a  specified  interval,  say  1  sec. 
Timing-out  could  be  caused  by  a  variety  of  problans,  including 

1 .  blocked  frequency 

2.  signal  fading 

3 .  genuine  failure  of  the  aircraft  or  groimd  station  radio 

4.  failure  of  a  transmitter  or  receiver,  while  everything  else  still  works 

5.  failure  of  support  equipment  on  the  ground,  e,g.,  power,  cabling,  UART,  etc 

6.  software  bug  or  crash 

The  procedures  outlined  below  are  intended  to  retrieve  the  situation  if  the  problem  is  channel  blockage  or 
fading,  while  not  tnaking  things  worse  if  the  problem  is  something  else  (e,g.  by  losing  half  the  link  if  it  is 
still  working,  or  by  dwelling  on  a  frequency  which  we  ought  not  to  be  using.) 

It  is  important  to  note  that  assumption  of  comm  failure  by  one  side  does  no/  imply  that  the  other  side  has 
reached  the  same  conclusion.  On  the  one  hand,  if  only  the  downlink  were  to  fad,  then  the  aerosonde 
would  not  detect  the  problem  on  its  own.  Of  course  it  would  if  the  groxmd  side  switched  to  another 
frequency  ,  since  it  would  then  appear  as  if  the  uplink  had  failed  as  welL  However  it  would  be  better  for 
the  ground  side  first  to  announce  its  intentions  explicitfy..  Similarfy  if  only  the  uplink  were  to  fail,  then 
the  ground  side  would  continue  to  receive  ‘"broadcast”  messages  and  hence  not  have  a  comm  timeout 
(unless  only  acknowledgements  were  allowed  to  reset  the  timer.)  Again  it  would  be  best  for  the  aerosonde 
to  make  a  blind  announcement. 

IMMEDIATE  ACTION 

L  Time-out  detected  by  the  ground  Tattletale 

1 .  Groimd  TT  switches  to  high  RF  power,  if  not  akeacfy  there,  and  commands  the  aerosonde  to  do  the 
same. 

2.  Ground  TT  reports  apparent  downlink  failure  to  the  ground  PC,  and  announces  that  recovery  action 
will  be  taken  imminently  unless  comm  is  reestablished  or  the  operator  commands  otherwise. 

3 .  The  aircraft  should  be  commanded  to  do  something  which  can  quickly  be  checked  visualfy  or  audibly  - 
-  e,g.  flashing  lights;  changing  throttle  setting;  turning;  responding  to  manual  control.  The  Ught- 
flashing  command  can  be  issued  automatical^  by  the  ground  TT;  the  others  would  have  to  be  initiated 
by  the  crew,  and  quickly. 

4.  If  the  uplink  turns  out  to  be  working,  then  the  crew  should  conunand  communication  on  the  primary 
frequency,  and  land  ASAP. 

5.  If  the  uplink  is  apparent^  not  working,  then  the  ground  TT  should 

a)  command  the  aerosonde  to  begin  the  comm-failure  protocol 

b)  begin  the  comm-failure  protocol,  q.v. 

2.  Time-out  detected  by  the  aerosonde 

1 .  Aerosonde  switches  to  high  RF  power,  if  not  alrea^  there. 

2.  Aerosonde  makes  itself  SAFE  for  autonomous  operation: 
a)  airspeed,  altitude,  and  yaw-rate  loops  ON 


b)  tracking  ON,  if  altitude  is  sufficient..  Otherwise,  climb  straight-ahead  to  sufficient  altitude,  and 
then  switch  to  tracking  ON.  Tracking  should  start  on  the  last  commanded  flight-plan  s^ment,  if  it 
is  vahd,  or  otherwise  on  the  first  vahd  segment  on  the  s^ment  list 

c)  lights  ON 

3 .  Aerosonde  announces  that  it  is  starting  the  comm- failure  protocol 

4.  Aerosonde  b^ins  the  comm-failure  protocol 


FAILURE-RECOVERY  PROTOCOL 


tgb  ?  tab  ?  tgp 


tgn 


gnd  TT  commands  switch 
to  backup  fieq 


aerosonde  announces 
switch  to  backup  fteq 


|gndTT  initiates  probe  on 
backup  fieq 


tgn  ?  tan  ? _ tu _ td _ tgb+  T 


gnd  TT  commands  switch 
toprimary  fteq 

gnd  TT  sends  uplink 
commands  on  primary  fireq 

aerosonde  sends  std  telemetry 
on  primary  fteq 

In  the  hope  of  finding  a  fi-equency  that  works,  the  aerosonde  and  ground  station  should  <^cle  through  the 
protocol  illustrated  in  the  figure  above.  The  protocol  dqjends  upon  synchronisation  between  ground  and 
aircraft,  which  in  turn  depends  upon  each  side  having  estabhshed  (via  GPS)  an  accurate  absolute  clock. 
Each  side  wiU  have  a  the  same  table  of  backup  fi-equencies  and  time  slots: 


UTC  mod  NT 

FreqO 

0 

Freq  1 

Tb 

2Tb 

r: 

... 

ESiSSIH 

(N-l)Tb 

Given  this  table  and  an  accurate  clock,  the  protocol  is  as  follows: 

1 .  EstabUsh  a  timer  sychronised  to  UTC  as  provided  by  GPS 

2.  Timing  starts  at  tgb.  At  this  time 

a)  Each  side  sets  a  timer  for  tgp 

b)  Each  side  sets  its  modem  to  the  appropriate  backup  frequency 

c)  The  ground  TT  reports  the  new  frequency  to  the  ground  PC 

d)  The  ground  TT  attempts  to  get  acknowledgement  on  the  new  frequency 

i)  It  sends  a  test  message 

ii)  It  awaits  acknowledgement  for  a  specified  interval 

iii)  It  rq)eats  i-ii  some  specified  number  of  times,  or  until  contact  is  estabhshed 

3.  If  acknowledgement  is  received,  then 

a)  The  ground  TT  commands  the  aerosonde  to  stop  the  comm  failure  protocol 

b)  The  ground  TT  stops  its  own  protocol 

c)  The  ground  TT  command  the  aerosonde  to  store  the  current  frequency  as  the  first-choice  backup 
4*  Otherwise,  when  the  timer  reaches  tu 

a)  Each  side  sets  a  timer  for  the  td 

b)  Each  side  sets  its  modem  to  the  primary  frequency 

c)  The  ground  side  sends  queued  packets  until  timeout  at  td 

d)  If  acknowledgement  is  received  then  (4)  above 

5.  When  the  timer  reaches  td 


a)  Each  side  sets  a  timer  for  tgb+T 

b)  The  aerosonde  sends  queued  packets  until  timeout  at  tgb+T 

6.  Repeat  2-6  some  specified  number  of  times  with  the  first-choice  backup  fi-equaicy.  If  that  fails.  Set  an 
index  into  the  backup-firequency  table  based  on  the  currait  UTC  and  repeat  2-6  imtil  all  backup 
firequencies  have  been  tried 

7.  After  all  backup  fi^equencies  have  been  tried  without  success,  set  a  time  to  repeat  the  full  protocol  if 
comm  is  not  reestabhshed  in  the  interim  (as  indicated  by  a  lost-link  flag),  and  continue  with  only  steps 
5  and  6. 


